<?php
// app-asset.php — sert les assets (CSS/JS/images) depuis le dossier utilisateur via ton domaine
session_start();

if (empty($_SESSION['proxy_base'])) {
    http_response_code(403);
    exit('Forbidden');
}
$base = $_SESSION['proxy_base']; // ex: https://domaine.fr/Z/A/P/dossier

if (empty($_GET['f'])) {
    http_response_code(400);
    exit('Missing asset');
}
$rel = base64_decode($_GET['f'], true);
if ($rel === false) {
    http_response_code(400);
    exit('Bad asset ref');
}
$rel = ltrim($rel, '/');
$url = rtrim($base, '/') . '/' . $rel;

// Proxy l’asset binaire
$ch = curl_init($url);
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_FOLLOWLOCATION => true,
    CURLOPT_HEADER         => true,
    CURLOPT_TIMEOUT        => 20,
    CURLOPT_SSL_VERIFYPEER => false,
    CURLOPT_SSL_VERIFYHOST => 0,
    CURLOPT_USERAGENT      => $_SERVER['HTTP_USER_AGENT'] ?? 'ProxyAsset',
]);
$response = curl_exec($ch);
if ($response === false) {
    http_response_code(502);
    echo "Asset error";
    exit;
}
$headerSize = curl_getinfo($ch, CURLINFO_HEADER_SIZE);
$headersRaw = substr($response, 0, $headerSize);
$body       = substr($response, $headerSize);
$contentType= curl_getinfo($ch, CURLINFO_CONTENT_TYPE) ?: 'application/octet-stream';
curl_close($ch);

// Envoie le bon content-type et l’asset
header('Content-Type: ' . $contentType);
header('Cache-Control: private, max-age=300');
echo $body;